@trokky/trokky 2.0.3

package/dist/core/security/rate-limiter.js

@@ -0,0 +1,48 @@
+import { RateLimitError } from '../errors/index.js';
+export class RateLimiter {
+    operationCounts = new Map();
+    defaultConfig = {
+        windowMs: 60 * 1000, // 1 minute
+        maxRequests: 1000
+    };
+    constructor(config = {}) {
+        this.config = { ...this.defaultConfig, ...config };
+    }
+    config;
+    async checkRateLimit(operation, context) {
+        const key = this.config.keyGenerator
+            ? this.config.keyGenerator(operation, context)
+            : operation;
+        const now = Date.now();
+        const windowStart = Math.floor(now / this.config.windowMs) * this.config.windowMs;
+        const current = this.operationCounts.get(key);
+        if (!current || current.windowStart < windowStart) {
+            // New window or first request
+            this.operationCounts.set(key, { count: 1, windowStart });
+            return;
+        }
+        if (current.count >= this.config.maxRequests) {
+            throw new RateLimitError(operation);
+        }
+        current.count++;
+    }
+    cleanup() {
+        const now = Date.now();
+        const cutoff = now - this.config.windowMs * 2; // Keep 2 windows of history
+        for (const [key, data] of this.operationCounts.entries()) {
+            if (data.windowStart < cutoff) {
+                this.operationCounts.delete(key);
+            }
+        }
+    }
+    getRemainingRequests(operation) {
+        const now = Date.now();
+        const windowStart = Math.floor(now / this.config.windowMs) * this.config.windowMs;
+        const current = this.operationCounts.get(operation);
+        if (!current || current.windowStart < windowStart) {
+            return this.config.maxRequests;
+        }
+        return Math.max(0, this.config.maxRequests - current.count);
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/core/security/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/core/security/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAQnD,MAAM,OAAO,WAAW;IACd,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAA;IAClE,aAAa,GAAoB;QAChD,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;QAChC,WAAW,EAAE,IAAI;KAClB,CAAA;IAED,YAAY,SAAmC,EAAE;QAC/C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,MAAM,EAAE,CAAA;IACpD,CAAC;IAEO,MAAM,CAAiB;IAExB,KAAK,CAAC,cAAc,CACzB,SAAiB,EACjB,OAAiC;QAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY;YAClC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;YAC9C,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAA;QAEjF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAE7C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,GAAG,WAAW,EAAE,CAAC;YAClD,8BAA8B;YAC9B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAA;YACxD,OAAM;QACR,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CAAC,SAAS,CAAC,CAAA;QACrC,CAAC;QAED,OAAO,CAAC,KAAK,EAAE,CAAA;IACjB,CAAC;IAEM,OAAO;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAA,CAAC,4BAA4B;QAE1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,WAAW,GAAG,MAAM,EAAE,CAAC;gBAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAEM,oBAAoB,CAAC,SAAiB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAA;QAEjF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAEnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,GAAG,WAAW,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAA;QAChC,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC;CACF"}

package/dist/core/security/validation.d.ts

@@ -0,0 +1,20 @@
+import { ListOptions } from '../types/index.js';
+export declare class SecurityValidator {
+    private static readonly COLLECTION_NAME_REGEX;
+    private static readonly ID_REGEX;
+    private static readonly MAX_COLLECTION_NAME_LENGTH;
+    private static readonly MAX_ID_LENGTH;
+    private static readonly MAX_LIMIT;
+    private static readonly MAX_SORT_FIELDS;
+    static validateCollectionName(name: string): void;
+    static validateDocumentId(id: string): void;
+    static sanitizeListOptions(options?: ListOptions): ListOptions | undefined;
+    private static validateSortField;
+    static sanitizeFilter(filter: unknown): Record<string, unknown>;
+    private static sanitizeFilterValue;
+    static validateDocumentData(data: unknown): void;
+    static validateUsername(username: string): void;
+    static validateEmail(email: string): void;
+    static validatePassword(password: string): void;
+}
+//# sourceMappingURL=validation.d.ts.map

package/dist/core/security/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/core/security/validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IAC1E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAK;IACvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAM;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAO;IACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAI;WAE7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;WA8B1C,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;WAwBpC,mBAAmB,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS;IAoDjF,OAAO,CAAC,MAAM,CAAC,iBAAiB;WAgBlB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IA+CtE,OAAO,CAAC,MAAM,CAAC,mBAAmB;WAkBpB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;WAoCzC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;WAwCxC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;WAoClC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;CAyCvD"}

package/dist/core/security/validation.js

@@ -0,0 +1,273 @@
+import { InvalidInputError } from '../errors/index.js';
+export class SecurityValidator {
+    static COLLECTION_NAME_REGEX = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+    static ID_REGEX = /^[a-zA-Z0-9-_]+$/;
+    static MAX_COLLECTION_NAME_LENGTH = 50;
+    static MAX_ID_LENGTH = 100;
+    static MAX_LIMIT = 1000;
+    static MAX_SORT_FIELDS = 5;
+    static validateCollectionName(name) {
+        if (typeof name !== 'string') {
+            throw new InvalidInputError('Collection name must be a string', 'collection');
+        }
+        if (!name || name.length === 0) {
+            throw new InvalidInputError('Collection name cannot be empty', 'collection');
+        }
+        if (name.length > this.MAX_COLLECTION_NAME_LENGTH) {
+            throw new InvalidInputError(`Collection name too long (max ${this.MAX_COLLECTION_NAME_LENGTH} characters)`, 'collection');
+        }
+        if (!this.COLLECTION_NAME_REGEX.test(name)) {
+            throw new InvalidInputError('Collection name must start with a letter and contain only letters, numbers, underscores, and hyphens', 'collection');
+        }
+        // Prevent reserved names
+        const reservedNames = ['admin', 'api', 'system', 'config', 'schema', 'migration'];
+        if (reservedNames.includes(name.toLowerCase())) {
+            throw new InvalidInputError(`Collection name '${name}' is reserved`, 'collection');
+        }
+    }
+    static validateDocumentId(id) {
+        if (typeof id !== 'string') {
+            throw new InvalidInputError('Document ID must be a string', 'id');
+        }
+        if (!id || id.length === 0) {
+            throw new InvalidInputError('Document ID cannot be empty', 'id');
+        }
+        if (id.length > this.MAX_ID_LENGTH) {
+            throw new InvalidInputError(`Document ID too long (max ${this.MAX_ID_LENGTH} characters)`, 'id');
+        }
+        if (!this.ID_REGEX.test(id)) {
+            throw new InvalidInputError('Document ID must contain only letters, numbers, underscores, and hyphens', 'id');
+        }
+    }
+    static sanitizeListOptions(options) {
+        if (!options || typeof options !== 'object') {
+            return undefined;
+        }
+        const sanitized = {};
+        // Sanitize limit
+        if (options.limit !== undefined) {
+            if (typeof options.limit !== 'number' || !Number.isInteger(options.limit)) {
+                throw new InvalidInputError('Limit must be an integer', 'limit');
+            }
+            sanitized.limit = Math.min(Math.max(options.limit, 1), this.MAX_LIMIT);
+        }
+        // Sanitize offset
+        if (options.offset !== undefined) {
+            if (typeof options.offset !== 'number' || !Number.isInteger(options.offset)) {
+                throw new InvalidInputError('Offset must be an integer', 'offset');
+            }
+            sanitized.offset = Math.max(options.offset, 0);
+        }
+        // Sanitize sort
+        if (options.sort !== undefined) {
+            if (typeof options.sort === 'string') {
+                this.validateSortField(options.sort);
+                sanitized.sort = options.sort;
+            }
+            else if (Array.isArray(options.sort)) {
+                if (options.sort.length > this.MAX_SORT_FIELDS) {
+                    throw new InvalidInputError(`Too many sort fields (max ${this.MAX_SORT_FIELDS})`, 'sort');
+                }
+                for (const field of options.sort) {
+                    this.validateSortField(field);
+                }
+                sanitized.sort = options.sort.slice(0, this.MAX_SORT_FIELDS);
+            }
+            else {
+                throw new InvalidInputError('Sort must be a string or array of strings', 'sort');
+            }
+        }
+        // Sanitize filter
+        if (options.filter !== undefined) {
+            sanitized.filter = this.sanitizeFilter(options.filter);
+        }
+        return sanitized;
+    }
+    static validateSortField(field) {
+        if (typeof field !== 'string') {
+            throw new InvalidInputError('Sort field must be a string', 'sort');
+        }
+        // Allow: "field", "-field", "field.asc", "field.desc"
+        // The "-field" format is converted to "field.desc" by routes layer
+        const sortPattern = /^-?[a-zA-Z_][a-zA-Z0-9_]*(\.(asc|desc))?$/;
+        if (!sortPattern.test(field)) {
+            throw new InvalidInputError('Invalid sort field format. Use "field", "-field", "field.asc" or "field.desc"', 'sort');
+        }
+    }
+    static sanitizeFilter(filter) {
+        if (!filter || typeof filter !== 'object' || Array.isArray(filter)) {
+            return {};
+        }
+        const sanitized = {};
+        const filterObj = filter;
+        // Limit filter depth and complexity
+        const maxFilterKeys = 10;
+        const keys = Object.keys(filterObj).slice(0, maxFilterKeys);
+        for (const key of keys) {
+            if (typeof key !== 'string' || key.length === 0) {
+                continue;
+            }
+            // Validate field names
+            if (!/^[a-zA-Z_][a-zA-Z0-9_.]*$/.test(key)) {
+                throw new InvalidInputError(`Invalid filter field name: ${key}`, 'filter');
+            }
+            // Prevent dangerous operators and properties
+            const dangerousFields = ['__proto__', 'constructor', 'prototype'];
+            if (key.startsWith('$') || dangerousFields.some(dangerous => key.includes(dangerous))) {
+                throw new InvalidInputError(`Forbidden filter field: ${key}`, 'filter');
+            }
+            const value = filterObj[key];
+            // Basic type validation for filter values
+            if (value !== null && typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') {
+                if (Array.isArray(value)) {
+                    // Allow simple arrays for "in" queries
+                    sanitized[key] = value.slice(0, 100); // Limit array size
+                }
+                else if (typeof value === 'object') {
+                    // Allow simple comparison objects
+                    sanitized[key] = this.sanitizeFilterValue(value);
+                }
+            }
+            else {
+                sanitized[key] = value;
+            }
+        }
+        return sanitized;
+    }
+    static sanitizeFilterValue(value) {
+        const allowedOperators = ['$eq', '$ne', '$gt', '$gte', '$lt', '$lte', '$in', '$nin'];
+        const sanitized = {};
+        for (const [op, val] of Object.entries(value)) {
+            if (allowedOperators.includes(op)) {
+                // Basic validation for operator values
+                if (['$in', '$nin'].includes(op) && Array.isArray(val)) {
+                    sanitized[op] = val.slice(0, 100); // Limit array size
+                }
+                else if (val !== null && ['string', 'number', 'boolean'].includes(typeof val)) {
+                    sanitized[op] = val;
+                }
+            }
+        }
+        return sanitized;
+    }
+    static validateDocumentData(data) {
+        if (!data || typeof data !== 'object' || Array.isArray(data)) {
+            throw new InvalidInputError('Document data must be an object', 'data');
+        }
+        const dataObj = data;
+        // Check for dangerous properties
+        const dangerousKeys = ['__proto__', 'constructor', 'prototype'];
+        for (const key of Object.keys(dataObj)) {
+            if (dangerousKeys.includes(key)) {
+                throw new InvalidInputError(`Forbidden property name: ${key}`, 'data');
+            }
+            // Validate field names
+            if (typeof key !== 'string' || key.length === 0) {
+                throw new InvalidInputError('Field names must be non-empty strings', 'data');
+            }
+            if (key.length > 100) {
+                throw new InvalidInputError('Field name too long (max 100 characters)', 'data');
+            }
+            // Validate field name format (letters, numbers, underscores only)
+            if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(key)) {
+                throw new InvalidInputError(`Invalid field name format: ${key}`, 'data');
+            }
+        }
+        // Check object size
+        const jsonString = JSON.stringify(data);
+        if (jsonString.length > 10 * 1024 * 1024) { // 10MB limit
+            throw new InvalidInputError('Document too large (max 10MB)', 'data');
+        }
+    }
+    static validateUsername(username) {
+        if (typeof username !== 'string') {
+            throw new InvalidInputError('Username must be a string', 'username');
+        }
+        if (!username || username.length === 0) {
+            throw new InvalidInputError('Username cannot be empty', 'username');
+        }
+        if (username.length < 3) {
+            throw new InvalidInputError('Username must be at least 3 characters long', 'username');
+        }
+        if (username.length > 50) {
+            throw new InvalidInputError('Username too long (max 50 characters)', 'username');
+        }
+        // Username can contain letters, numbers, underscores, and hyphens
+        if (!/^[a-zA-Z0-9_-]+$/.test(username)) {
+            throw new InvalidInputError('Username must contain only letters, numbers, underscores, and hyphens', 'username');
+        }
+        // Must start with a letter or number
+        if (!/^[a-zA-Z0-9]/.test(username)) {
+            throw new InvalidInputError('Username must start with a letter or number', 'username');
+        }
+        // Reserved usernames (system-level reservations, but allow admin for CMS)
+        const reservedUsernames = [
+            'root', 'system', 'api', 'www', 'mail', 'ftp',
+            'user', 'guest', 'anonymous', 'test', 'demo', 'support', 'null', 'undefined'
+        ];
+        if (reservedUsernames.includes(username.toLowerCase())) {
+            throw new InvalidInputError(`Username '${username}' is reserved`, 'username');
+        }
+    }
+    static validateEmail(email) {
+        if (typeof email !== 'string') {
+            throw new InvalidInputError('Email must be a string', 'email');
+        }
+        if (!email || email.length === 0) {
+            throw new InvalidInputError('Email cannot be empty', 'email');
+        }
+        if (email.length > 320) { // RFC 5321 limit
+            throw new InvalidInputError('Email too long (max 320 characters)', 'email');
+        }
+        // Basic email validation regex
+        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        if (!emailRegex.test(email)) {
+            throw new InvalidInputError('Invalid email format', 'email');
+        }
+        // Check for dangerous characters
+        const dangerousChars = ['<', '>', '"', "'", '&', '%', '$', '#', '!', '?', '*'];
+        if (dangerousChars.some(char => email.includes(char))) {
+            throw new InvalidInputError('Email contains invalid characters', 'email');
+        }
+        // Validate local part length (before @)
+        const [localPart, domain] = email.split('@');
+        if (localPart.length > 64) {
+            throw new InvalidInputError('Email local part too long (max 64 characters)', 'email');
+        }
+        if (domain.length > 253) {
+            throw new InvalidInputError('Email domain too long (max 253 characters)', 'email');
+        }
+    }
+    static validatePassword(password) {
+        if (typeof password !== 'string') {
+            throw new InvalidInputError('Password must be a string', 'password');
+        }
+        if (!password || password.length === 0) {
+            throw new InvalidInputError('Password cannot be empty', 'password');
+        }
+        if (password.length < 8) {
+            throw new InvalidInputError('Password must be at least 8 characters long', 'password');
+        }
+        if (password.length > 128) {
+            throw new InvalidInputError('Password too long (max 128 characters)', 'password');
+        }
+        // Check password strength (optional but recommended)
+        const hasUpperCase = /[A-Z]/.test(password);
+        const hasLowerCase = /[a-z]/.test(password);
+        const hasNumber = /[0-9]/.test(password);
+        const hasSpecialChar = /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?]/.test(password);
+        const strengthCount = [hasUpperCase, hasLowerCase, hasNumber, hasSpecialChar].filter(Boolean).length;
+        if (strengthCount < 2) {
+            throw new InvalidInputError('Password must contain at least 2 of: uppercase letters, lowercase letters, numbers, special characters', 'password');
+        }
+        // Check for common weak passwords
+        const weakPasswords = [
+            'password', '12345678', 'qwerty', 'abc123', 'password123',
+            'admin', 'letmein', 'welcome', 'monkey', '1234567890'
+        ];
+        if (weakPasswords.includes(password.toLowerCase())) {
+            throw new InvalidInputError('Password is too common, please choose a stronger password', 'password');
+        }
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/core/security/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/core/security/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAGtD,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAU,qBAAqB,GAAG,0BAA0B,CAAA;IAClE,MAAM,CAAU,QAAQ,GAAG,kBAAkB,CAAA;IAC7C,MAAM,CAAU,0BAA0B,GAAG,EAAE,CAAA;IAC/C,MAAM,CAAU,aAAa,GAAG,GAAG,CAAA;IACnC,MAAM,CAAU,SAAS,GAAG,IAAI,CAAA;IAChC,MAAM,CAAU,eAAe,GAAG,CAAC,CAAA;IAEpC,MAAM,CAAC,sBAAsB,CAAC,IAAY;QAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,EAAE,YAAY,CAAC,CAAA;QAC/E,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,EAAE,YAAY,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAClD,MAAM,IAAI,iBAAiB,CACzB,iCAAiC,IAAI,CAAC,0BAA0B,cAAc,EAC9E,YAAY,CACb,CAAA;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,iBAAiB,CACzB,sGAAsG,EACtG,YAAY,CACb,CAAA;QACH,CAAC;QAED,yBAAyB;QACzB,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;QACjF,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,IAAI,eAAe,EAAE,YAAY,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,kBAAkB,CAAC,EAAU;QACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAA;QACnE,CAAC;QAED,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAA;QAClE,CAAC;QAED,IAAI,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,IAAI,CAAC,aAAa,cAAc,EAC7D,IAAI,CACL,CAAA;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CACzB,0EAA0E,EAC1E,IAAI,CACL,CAAA;QACH,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,mBAAmB,CAAC,OAAqB;QACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,MAAM,SAAS,GAAgB,EAAE,CAAA;QAEjC,iBAAiB;QACjB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAA;YAClE,CAAC;YACD,SAAS,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QACxE,CAAC;QAED,kBAAkB;QAClB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAA;YACpE,CAAC;YACD,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAChD,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACpC,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;YAC/B,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;oBAC/C,MAAM,IAAI,iBAAiB,CACzB,6BAA6B,IAAI,CAAC,eAAe,GAAG,EACpD,MAAM,CACP,CAAA;gBACH,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;gBAC/B,CAAC;gBACD,SAAS,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAA;YAC9D,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,iBAAiB,CAAC,2CAA2C,EAAE,MAAM,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;QAED,kBAAkB;QAClB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACxD,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,MAAM,CAAC,iBAAiB,CAAC,KAAa;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;QACpE,CAAC;QAED,sDAAsD;QACtD,mEAAmE;QACnE,MAAM,WAAW,GAAG,2CAA2C,CAAA;QAC/D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,iBAAiB,CACzB,+EAA+E,EAC/E,MAAM,CACP,CAAA;QACH,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,cAAc,CAAC,MAAe;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,SAAS,GAA4B,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,MAAiC,CAAA;QAEnD,oCAAoC;QACpC,MAAM,aAAa,GAAG,EAAE,CAAA;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAE3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,SAAQ;YACV,CAAC;YAED,uBAAuB;YACvB,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAA;YAC5E,CAAC;YAED,6CAA6C;YAC7C,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;YACjE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAE5B,0CAA0C;YAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC3G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,uCAAuC;oBACvC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA,CAAC,mBAAmB;gBAC1D,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrC,kCAAkC;oBAClC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,mBAAmB,CAAC,KAAgC,CAAC,CAAA;gBAC7E,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YACxB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,KAA8B;QAC/D,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QACpF,MAAM,SAAS,GAA4B,EAAE,CAAA;QAE7C,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,uCAAuC;gBACvC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvD,SAAS,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA,CAAC,mBAAmB;gBACvD,CAAC;qBAAM,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;oBAChF,SAAS,CAAC,EAAE,CAAC,GAAG,GAAG,CAAA;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAEM,MAAM,CAAC,oBAAoB,CAAC,IAAa;QAC9C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAA;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,IAA+B,CAAA;QAE/C,iCAAiC;QACjC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;QAC/D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;YACxE,CAAC;YAED,uBAAuB;YACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAA;YAC9E,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,MAAM,CAAC,CAAA;YACjF,CAAC;YAED,kEAAkE;YAClE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,aAAa;YACvD,MAAM,IAAI,iBAAiB,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAA;QACtE,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,EAAE,UAAU,CAAC,CAAA;QACxF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,iBAAiB,CAAC,uCAAuC,EAAE,UAAU,CAAC,CAAA;QAClF,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CACzB,uEAAuE,EACvE,UAAU,CACX,CAAA;QACH,CAAC;QAED,qCAAqC;QACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,EAAE,UAAU,CAAC,CAAA;QACxF,CAAC;QAED,0EAA0E;QAC1E,MAAM,iBAAiB,GAAG;YACxB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;YAC7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW;SAC7E,CAAA;QACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,iBAAiB,CAAC,aAAa,QAAQ,eAAe,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAA;QAC/D,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,iBAAiB;YACzC,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAA;QAC7E,CAAC;QAED,+BAA+B;QAC/B,MAAM,UAAU,GAAG,4BAA4B,CAAA;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAA;QAC9D,CAAC;QAED,iCAAiC;QACjC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC9E,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAA;QAC3E,CAAC;QAED,wCAAwC;QACxC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5C,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,EAAE,OAAO,CAAC,CAAA;QACvF,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,EAAE,OAAO,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAEM,MAAM,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAA;QACtE,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,iBAAiB,CAAC,6CAA6C,EAAE,UAAU,CAAC,CAAA;QACxF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,iBAAiB,CAAC,wCAAwC,EAAE,UAAU,CAAC,CAAA;QACnF,CAAC;QAED,qDAAqD;QACrD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,cAAc,GAAG,uCAAuC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAE7E,MAAM,aAAa,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;QAEpG,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,iBAAiB,CACzB,wGAAwG,EACxG,UAAU,CACX,CAAA;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,aAAa,GAAG;YACpB,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa;YACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY;SACtD,CAAA;QACD,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,iBAAiB,CAAC,2DAA2D,EAAE,UAAU,CAAC,CAAA;QACtG,CAAC;IACH,CAAC"}

package/dist/core/services/auth-service.d.ts

@@ -0,0 +1,128 @@
+import type { CryptoAdapter } from '../crypto/adapter.js';
+import type { TrokkyLogger } from '../utils/logger.js';
+import type { AuditEvent } from '../core/engine.js';
+import type { MFARequirement } from './mfa-service.js';
+import type { TOTPService } from '../security/mfa/index.js';
+import type { AppToken, AuthenticationResult, AuthenticationSuccessResult, MFAMethodType, TrokkyConfig, TrustedDevice, UpdateUserData, User, UserSession } from '../types/index.js';
+export interface AuthServiceDependencies {
+    cryptoAdapter: CryptoAdapter;
+    jwtSecret: string;
+    config: TrokkyConfig;
+    logger: TrokkyLogger;
+    getUser: (id: string) => Promise<User | null>;
+    getUserByUsername: (username: string) => Promise<User | null>;
+    updateUser: (id: string, userData: UpdateUserData) => Promise<User>;
+    /** Conditional update, present only when the data adapter supports saveUserIf */
+    updateUserIf?: (id: string, userData: Partial<UpdateUserData>, condition: {
+        passwordHash: string;
+    }) => Promise<User | null>;
+    validateAppToken: (token: string) => Promise<{
+        valid: boolean;
+        appToken?: AppToken;
+        error?: string;
+    }>;
+    logAuditEvent: (event: AuditEvent) => void;
+    checkMFARequired: (userId: string) => Promise<MFARequirement>;
+    isDeviceTrusted: (userId: string, deviceId: string) => Promise<boolean>;
+    trustDevice: (userId: string, deviceId: string, deviceName: string, options?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }) => Promise<TrustedDevice>;
+    getTOTPService: (issuer?: string) => TOTPService;
+}
+/**
+ * Authentication service: password verification, JWT issuance and the
+ * login flows (including MFA hand-off). Extracted from TrokkyCore.
+ */
+export declare class AuthService {
+    private readonly deps;
+    constructor(deps: AuthServiceDependencies);
+    verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean>;
+    /**
+     * Hash a password using the configured crypto adapter
+     * Exposed publicly to ensure consistent hashing across all password operations
+     */
+    hashPassword(password: string): Promise<string>;
+    checkWeakPassword(password: string): {
+        isWeak: boolean;
+        reason?: string;
+    };
+    generateAuthToken(user: User, expiresIn?: string, rememberMe?: boolean): Promise<string>;
+    verifyAuthToken(token: string): Promise<UserSession | null>;
+    /**
+     * Unified token validation that handles both JWT and API tokens
+     * Returns a consistent UserSession interface for both token types
+     */
+    verifyAnyToken(token: string): Promise<UserSession | null>;
+    /**
+     * Authentication result types for MFA support
+     */
+    authenticateUser(username: string, password: string, options?: {
+        rememberMe?: boolean;
+        deviceId?: string;
+    }): Promise<AuthenticationResult | null>;
+    /**
+     * Issue full authentication tokens after successful login (including MFA if required)
+     */
+    issueFullTokens(user: User, options?: {
+        rememberMe?: boolean;
+    }): Promise<AuthenticationSuccessResult>;
+    /**
+     * Generate MFA pending token (used when MFA verification is needed)
+     */
+    generateMFAPendingToken(user: User, methods: MFAMethodType[]): Promise<string>;
+    /**
+     * Generate MFA setup token (used when org requires MFA but user hasn't set it up)
+     */
+    generateMFASetupToken(user: User, allowedMethods: MFAMethodType[]): Promise<string>;
+    /**
+     * Complete MFA verification and issue full tokens
+     * Call this after verifyMFACode returns true
+     */
+    completeMFAAuthentication(mfaToken: string, options?: {
+        rememberMe?: boolean;
+        trustDevice?: boolean;
+        deviceId?: string;
+        deviceName?: string;
+    }): Promise<AuthenticationSuccessResult | null>;
+    /**
+     * Verify MFA setup token and return user info
+     */
+    verifyMFASetupToken(setupToken: string): Promise<{
+        userId: string;
+        username: string;
+        allowedMethods: MFAMethodType[];
+    } | null>;
+    /**
+     * Verify any MFA token (pending or setup) and return payload
+     */
+    verifyMFAToken(token: string): Promise<{
+        type: 'mfa_pending' | 'mfa_setup';
+        userId: string;
+        username: string;
+        mfaMethods?: MFAMethodType[];
+        allowedMethods?: MFAMethodType[];
+    } | null>;
+    /**
+     * Complete MFA setup and issue full authentication tokens
+     * Used when a user sets up MFA during the login flow (when org requires MFA)
+     */
+    completeMFASetupAndLogin(setupToken: string, options?: {
+        rememberMe?: boolean;
+    }): Promise<AuthenticationSuccessResult | null>;
+    /**
+     * Verify a backup code for a user
+     * Returns result with remaining codes if valid
+     */
+    verifyBackupCode(userId: string, code: string): Promise<{
+        valid: boolean;
+        remainingCodes: string[];
+    }>;
+    refreshAuthToken(refreshToken: string): Promise<{
+        token: string;
+        refreshToken: string;
+        user: User;
+        expiresAt: string;
+    } | null>;
+}
+//# sourceMappingURL=auth-service.d.ts.map

package/dist/core/services/auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../../src/core/services/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,KAAK,EACV,QAAQ,EACR,oBAAoB,EACpB,2BAA2B,EAC3B,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,IAAI,EACJ,WAAW,EACZ,MAAM,mBAAmB,CAAA;AAE1B,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,aAAa,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7C,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IAC7D,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnE,iFAAiF;IACjF,YAAY,CAAC,EAAE,CACb,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,EACjC,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,KAChC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;IACzB,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrG,aAAa,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;IAC1C,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;IAC7D,eAAe,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACvE,WAAW,EAAE,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACjD,OAAO,CAAC,aAAa,CAAC,CAAA;IAC3B,cAAc,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,WAAW,CAAA;CACjD;AAED;;;GAGG;AACH,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,uBAAuB;IAG7C,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5F;;;OAGG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIrD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAgDnE,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,GAAE,MAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAY/F,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IA2CxE;;;OAGG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAyBvE;;OAEG;IACU,gBAAgB,CAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GACxD,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkKvC;;OAEG;IACU,eAAe,CAC1B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrC,OAAO,CAAC,2BAA2B,CAAC;IA0CvC;;OAEG;IACU,uBAAuB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAU3F;;OAEG;IACU,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhG;;;OAGG;IACU,yBAAyB,CACpC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GACpG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;IAsC9C;;OAEG;IACU,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5D,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,aAAa,EAAE,CAAA;KAChC,GAAG,IAAI,CAAC;IAuBT;;OAEG;IACU,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAClD,IAAI,EAAE,aAAa,GAAG,WAAW,CAAA;QACjC,MAAM,EAAE,MAAM,CAAA;QACd,QAAQ,EAAE,MAAM,CAAA;QAChB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;QAC5B,cAAc,CAAC,EAAE,aAAa,EAAE,CAAA;KACjC,GAAG,IAAI,CAAC;IA+BT;;;OAGG;IACU,wBAAwB,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACrC,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC;IA0C9C;;;OAGG;IACU,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACnE,KAAK,EAAE,OAAO,CAAA;QACd,cAAc,EAAE,MAAM,EAAE,CAAA;KACzB,CAAC;IA2BW,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CA6C5I"}